[xwiki-users] Regular problem: Login cookie validation hash mismatch! Cookies have been tampered with
Hello, we have a regular problem when we cycle off-on our tomcat instance. Logged in users suddently have blank pages instead of their wiki pages. And we have tons of these errors in the logs. The only solution we have is to ask users to clean their cookies. (A close / reopen browser should be enough for most users). Shouldn't xwiki send new cookies if the old ones have been 'tampered' with? See error log below, Regards, David Delbecq 2008-04-02 09:43:20,630 [http://intrarmi.oma.be:8081/xwiki/bin/view/Main/WebHome?language=fr] [http-8081-Processor11] WARN xwiki.MyPersistentLoginManager - Login cookie validation hash mismatch! Cookies have been tampered with 2008-04-02 09:43:20,631 [http://intrarmi.oma.be:8081/xwiki/bin/view/Main/WebHome?language=fr] [http-8081-Processor11] WARN xwiki.MyPersistentLoginManager - Login cookie validation hash mismatch! Cookies have been tampered with 2008-04-02 09:43:20,988 [http://intrarmi.oma.be:8081/xwiki/bin/view/Main/WebHome?language=fr] [http-8081-Processor11] WARN xwiki.MyPersistentLoginManager - Login cookie validation hash mismatch! Cookies have been tampered with 2008-04-02 09:43:20,989 [http://intrarmi.oma.be:8081/xwiki/bin/view/Main/WebHome?language=fr] [http-8081-Processor11] WARN xwiki.MyPersistentLoginManager - Login cookie validation hash mismatch! Cookies have been tampered with 2008-04-02 09:43:21,597 [http://intrarmi.oma.be:8081/xwiki/bin/view/Main/WebHome?language=fr] [http-8081-Processor11] WARN web.XWikiAction - Uncaught exception: Error number 0 in 11: Uncaught exception Wrapped Exception: 4096 com.xpn.xwiki.XWikiException: Error number 0 in 11: Uncaught exception Wrapped Exception: 4096 at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:214) at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431) at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236) at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196) at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173) at com.xpn.xwiki.web.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:117) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:526) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:526) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:825) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:738) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:526) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684) at java.lang.Thread.run(Thread.java:595) Wrapped Exception: java.lang.ArrayIndexOutOfBoundsException: 4096 at org.apache.coyote.http11.InternalOutputBuffer.write(InternalOutputBuffer.java:721) at org.apache.coyote.http11.InternalOutputBuffer.write(InternalOutputBuffer.java:628) at org.apache.coyote.http11.InternalOutputBuffer.sendHeader(InternalOutputBuffer.java:501) at org.apache.coyote.http11.Http11Processor.prepareResponse(Http11Processor.java:1561) at org.apache.coyote.http11.Http11Processor.action(Http11Processor.java:918) at org.apache.coyote.Response.action(Response.java:180) at org.apache.coyote.http11.InternalOutputBuffer.doWrite(InternalOutputBuffer.java:573) at org.apache.coyote.Response.doWrite(Response.java:551) at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:361) at org.apache.tomcat.util.buf.ByteChunk.flushBuffer(ByteChunk.java:403) at org.apache.tomcat.util.buf.ByteChunk.append(ByteChunk.java:323) at org.apache.catalina.connector.OutputBuffer.writeBytes(OutputBuffer.java:392) at org.apache.catalina.connector.OutputBuffer.write(OutputBuffer.java:381) at org.apache.catalina.connector.CoyoteOutputStream.write(CoyoteOutputStream.java:76) at org.apache.catalina.connector.CoyoteOutputStream.write(CoyoteOutputStream.java:70) at com.xpn.xwiki.web.Utils.parseTemplate(Utils.java:132) at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:199) at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431) at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236) at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196) at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414) at javax.servlet.http.HttpServlet.service(HttpServlet.java:689) at javax.servlet.http.HttpServlet.service(HttpServlet.java:802) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173) at com.xpn.xwiki.web.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:117) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:526) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:526) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:825) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:738) at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:526) at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684) at java.lang.Thread.run(Thread.java:595)
On Wed, Apr 2, 2008 at 9:43 AM, David Delbecq <[email protected]> wrote:
Hello,
we have a regular problem when we cycle off-on our tomcat instance. Logged in users suddently have blank pages instead of their wiki pages. And we have tons of these errors in the logs. The only solution we have is to ask users to clean their cookies. (A close / reopen browser should be enough for most users). Shouldn't xwiki send new cookies if the old ones have been 'tampered' with?
Hello, this issue (XWIKI-2258) will be fixed in the XWiki Enterprise 1.3.1 release which will be shipped today. In the meantime you can download a snapshot version of xwiki core here : http://maven.xwiki.org/snapshots/com/xpn/xwiki/platform/xwiki-core/1.3-SNAPS... and replace your current xwiki-core-1.3.jar with it. -- Jean-Vincent Drean
David Delbecq wrote:
Hello,
we have a regular problem when we cycle off-on our tomcat instance. Logged in users suddently have blank pages instead of their wiki pages. And we have tons of these errors in the logs. The only solution we have is to ask users to clean their cookies. (A close / reopen browser should be enough for most users). Shouldn't xwiki send new cookies if the old ones have been 'tampered' with?
Yes, it tries that, but that is exactly why it crashes. This is caused by a wrong implementation of the cookie specification in the containers, so we had to find a workaround. It will be fixed in 1.3.1 (to be released this week). -- Sergiu Dumitriu http://purl.org/net/sergiu/
participants (3)
-
David Delbecq -
Jean-Vincent Drean -
Sergiu Dumitriu